chore(iceberg): remove dead S3 Tables backend

[benben]

S3 Tables was the original Iceberg backend; Lakekeeper has replaced it
end-to-end (see #635 / mw-dev validation across 9 duckling combos).
This rip-out drops the unused S3 Tables code path entirely — both
backends ATTACH against DuckDB iceberg, but the credential/secret shape
and ATTACH SQL are incompatible, so the dual-backend dispatcher was just
dead code carrying configuration and tests for a path nobody hits.

Production code

• server/iceberg: drop BackendS3Tables, TableBucket, BuildIcebergAttachStmt
• server/server.go: collapse AttachIcebergCatalog → Lakekeeper-only
  (drop attachS3TablesIcebergCatalog)
• duckdbservice/activation.go: drop TableBucket from sameTenantActivationRuntime
• configresolve / configloader / cliflags / cmd/duckgres-worker:
  drop --iceberg-table-bucket, DUCKGRES_ICEBERG_TABLE_BUCKET, YAML knob
• controlplane/configstore: drop ManagedWarehouseIceberg.TableBucketArn,
  IcebergBackendS3Tables const, migrateIcebergBackendBackfill one-shot
• controlplane/admin: drop iceberg_table_bucket_arn from update column list
• controlplane/org_router / shared_worker_activator: drop backend switch
• controlplane/provisioner: drop addIcebergStatusUpdates +
  applyIcebergUpdatesToWarehouse + tableBucketArn read on Duckling
  status; Lakekeeper readiness is owned by reconcileLakekeeper

The Backend column / constant is retained for forward-compat — empty
or legacy "s3_tables" rows now resolve to lakekeeper rather than
dispatching. The DB column iceberg_table_bucket_arn stays in the
schema (GORM doesn't drop columns) and is simply ignored.

Tests

• delete server/iceberg/dispatch_test.go (dispatcher gone)
• delete tests/k8s/iceberg_test.go (entirely S3-Tables-shaped; no
  Lakekeeper k8s test replacement in this PR — unit coverage in
  controlplane/shared_worker_activator_iceberg_test.go validates the
  Lakekeeper activation wiring)
• trim S3 Tables cases from migration_test, dispatch checks, refresh,
  column metadata, controller, activator tests
• main_test iceberg precedence test now exercises region/namespace
  knobs that remain

🤖 Generated with Claude Code